loco rewrite

2026-05-17 13:12:08 +02:00
commit 9fff6fbf7f
72 changed files with 3126 additions and 0 deletions
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -0,0 +1,10 @@
+[alias]
+loco = "run --"
+loco-tool = "run --"
+
+playground = "run --example playground"
+
+# https://github.com/rust-lang/rust/issues/141626
+# (can be removed once link.exe is fixed)
+[target.x86_64-pc-windows-msvc]
+linker = "rust-lld"
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,102 @@
+name: CI
+on:
+  push:
+    branches:
+      - master
+      - main
+  pull_request:
+
+env:
+  RUST_TOOLCHAIN: stable
+  TOOLCHAIN_PROFILE: minimal
+
+jobs:
+  rustfmt:
+    name: Check Style
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+          components: rustfmt
+      - name: Run cargo fmt
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
+  clippy:
+    name: Run Clippy
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@v2
+      - name: Run cargo clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idioms
+
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+    
+    services:
+      redis:
+        image: redis
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - "6379:6379"
+      postgres:
+        image: postgres
+        env:
+          POSTGRES_DB: postgres_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - "5432:5432"
+        # Set health checks to wait until postgres has started
+        options: --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@v2
+      - name: Run cargo test
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --all-features --all
+        env:
+          REDIS_URL: redis://localhost:${{job.services.redis.ports[6379]}}
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres_test
+          
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,22 @@
+**/config/local.yaml
+**/config/*.local.yaml
+**/config/production.yaml
+
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+
+# include cargo lock
+!Cargo.lock
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+*.sqlite
+*.sqlite-*
+.env
+.env.production
--- a/.rustfmt.toml
+++ b/.rustfmt.toml
@@ -0,0 +1,2 @@
+max_width = 100
+use_small_heuristics = "Default"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -0,0 +1,53 @@
+[workspace]
+
+[package]
+name = "universal_web"
+version = "0.1.0"
+edition = "2021"
+publish = false
+default-run = "universal_web-cli"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[workspace.dependencies]
+loco-rs = { version = "0.16" }
+
+[dependencies]
+loco-rs = { workspace = true  }
+serde = { version = "1", features = ["derive"] }
+serde_json = { version = "1" }
+tokio = { version = "1.45", default-features = false, features = [
+  "rt-multi-thread",
+] }
+async-trait = { version = "0.1" }
+axum = { version = "0.8" }
+tracing = { version = "0.1" }
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
+regex = { version = "1.11" }
+migration = { path = "migration" }
+sea-orm = { version = "1.1", features = [
+  "sqlx-sqlite",
+  "sqlx-postgres",
+  "runtime-tokio-rustls",
+  "macros",
+] }
+chrono = { version = "0.4" }
+validator = { version = "0.20" }
+uuid = { version = "1.6", features = ["v4"] }
+include_dir = { version = "0.7" }
+# view engine i18n
+fluent-templates = { version = "0.13", features = ["tera"] }
+unic-langid = { version = "0.9" }
+# /view engine
+axum-extra = { version = "0.10", features = ["form"] }
+
+[[bin]]
+name = "universal_web-cli"
+path = "src/bin/main.rs"
+required-features = []
+
+[dev-dependencies]
+loco-rs = { workspace = true, features = ["testing"] }
+serial_test = { version = "3.1.1" }
+rstest = { version = "0.25" }
+insta = { version = "1.34", features = ["redactions", "yaml", "filters"] }
--- a/README.md
+++ b/README.md
@@ -0,0 +1,58 @@
+# Welcome to Loco :train:
+
+[Loco](https://loco.rs) is a web and API framework running on Rust.
+
+This is the **SaaS starter** which includes a `User` model and authentication based on JWT.
+It also include configuration sections that help you pick either a frontend or a server-side template set up for your fullstack server.
+
+
+## Quick Start
+
+```sh
+cargo loco start
+```
+
+```sh
+$ cargo loco start
+Finished dev [unoptimized + debuginfo] target(s) in 21.63s
+    Running `target/debug/myapp start`
+
+    :
+    :
+    :
+
+controller/app_routes.rs:203: [Middleware] Adding log trace id
+
+                      ▄     ▀
+                                 ▀  ▄
+                  ▄       ▀     ▄  ▄ ▄▀
+                                    ▄ ▀▄▄
+                        ▄     ▀    ▀  ▀▄▀█▄
+                                          ▀█▄
+▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄ ▀▀█
+ ██████  █████   ███ █████   ███ █████   ███ ▀█
+ ██████  █████   ███ █████   ▀▀▀ █████   ███ ▄█▄
+ ██████  █████   ███ █████       █████   ███ ████▄
+ ██████  █████   ███ █████   ▄▄▄ █████   ███ █████
+ ██████  █████   ███  ████   ███ █████   ███ ████▀
+   ▀▀▀██▄ ▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀ ██▀
+       ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+                https://loco.rs
+
+environment: development
+   database: automigrate
+     logger: debug
+compilation: debug
+      modes: server
+
+listening on http://localhost:5150
+```
+
+## Full Stack Serving
+
+You can check your [configuration](config/development.yaml) to pick either frontend setup or server-side rendered template, and activate the relevant configuration sections.
+
+
+## Getting help
+
+Check out [a quick tour](https://loco.rs/docs/getting-started/tour/) or [the complete guide](https://loco.rs/docs/getting-started/guide/).
--- a/REWRITE_SPEC.md
+++ b/REWRITE_SPEC.md
@@ -0,0 +1,399 @@
+# Universal Web — Loco.rs Rewrite Specification
+
+This document is the implementation spec for re-building the existing **Axum** app
+(parent directory `../`) on top of **Loco.rs**. It captures every feature so the
+rewrite reaches parity. The GUI is being rewritten as part of this effort, so
+templates/markup are *not* meant to be ported verbatim — only behaviour and routes.
+
+- **Source app:** `../` — Axum 0.8, sqlx, Askama, axum-login, OpenDAL.
+- **Target app:** this directory — Loco 0.16 (SaaS, server-side rendered), SeaORM 1.1, Tera.
+- **Scaffold already generated by `loco new`:** auth controller, `users` model + migration,
+  auth mailer, background worker example, Tera view engine, i18n.
+
+---
+
+## 1. Stack mapping (old → Loco)
+
+| Concern            | Old (Axum)                                  | Loco target                                              |
+|--------------------|---------------------------------------------|----------------------------------------------------------|
+| HTTP framework     | Axum 0.8 + tower                            | Loco (Axum under the hood) — `controllers/`              |
+| DB access          | sqlx 0.8 (raw SQL, `query_as`)              | SeaORM 1.1 — entities in `models/_entities/`             |
+| Migrations         | `migrations/*.sql` (sqlx-cli)               | `migration/` crate (SeaORM, Rust DSL)                    |
+| Templating         | Askama (compile-time)                       | Tera (`assets/views/`) via `view_engine` initializer     |
+| Auth/session       | axum-login + tower-sessions (PG store)      | **Decision needed — see §3.1.** Loco ships JWT auth.     |
+| Password hashing   | argon2 0.5                                  | Loco built-in (`AuthnUser`/`hash_password`) — argon2     |
+| File storage       | OpenDAL 0.50 (fs/S3/Azure/GCS)              | Loco `storage` module (local/S3/multi-mirror)            |
+| Background jobs     | none (manual)                              | Loco workers (`workers/`) — bg mode `async` selected     |
+| Email              | none (verification stored, not sent)        | Loco mailers (`mailers/`) — scaffold already present     |
+| API docs           | utoipa + Swagger UI + Scalar                | Manual — see §13                                         |
+| Validation         | garde                                       | `validator` crate (already a dep)                        |
+| Config             | `.env` + `config.rs` singleton              | `config/{development,production,test}.yaml`              |
+| Logging            | tracing-subscriber                          | Loco logger (configured in yaml)                         |
+
+---
+
+## 2. Feature inventory (parity checklist)
+
+The old app ships these feature modules. Each must exist in the rewrite:
+
+- [ ] **Auth** — register, login, logout, current-user, email verification
+- [ ] **RBAC** — 4 roles, ~14 permissions, per-request permission loading
+- [ ] **Admin** — dashboard, user management, role assignment, audit log
+- [ ] **Blog** — articles CRUD, publish workflow, public listing, view counts
+- [ ] **Audio dashboard** — albums + tracks + tags CRUD, publish workflow
+- [ ] **Audio streaming** — range-aware track/file streaming, raw upload
+- [ ] **Audio player** — persistent bottom-bar player (frontend)
+- [ ] **Images** — upload + serve, used as cover/featured images
+- [ ] **Theme** — per-user light/dark preference
+- [ ] **Storage** — pluggable backend (fs default, S3/Azure/GCS capable)
+- [ ] **Home + layout** — landing page, dynamic navbar, footer
+- [ ] **Swagger/OpenAPI** — API docs (optional, lower priority)
+
+---
+
+## 3. Key migration decisions / gotchas
+
+### 3.1 Sessions vs JWT
+
+The old app uses **cookie sessions** (axum-login + `tower-sessions-sqlx-store`,
+1-day inactivity timeout, PG-backed `session` table). Loco's SaaS starter ships
+**JWT bearer auth** by default.
+
+Because this is a **server-side rendered** app (forms post HTML, navbar reflects
+auth state), bearer tokens are awkward. Recommended path:
+
+- Keep Loco's `users` model + password hashing + the `auth` controller for the
+  *API-style* endpoints.
+- Add **cookie-session middleware** for the HTML pages. Loco exposes the Axum
+  router, so `tower-sessions` can be layered in an initializer
+  (`src/initializers/`). Store the user id in the session.
+- Alternatively store the JWT in an `HttpOnly` cookie and add an extractor that
+  reads it from the cookie instead of the `Authorization` header.
+
+Pick one and apply it consistently. The old behaviour to match: login sets a
+cookie, navbar/`/auth/me` reflect it, logout clears it, ~1-day expiry.
+
+### 3.2 sqlx → SeaORM
+
+Every raw query becomes a SeaORM entity + `ActiveModel`. Generate entities from
+migrations with `cargo loco db entities`. Slug-uniqueness and `ON CONFLICT DO
+NOTHING` semantics must be re-expressed (unique index + handle the error).
+
+### 3.3 Askama → Tera
+
+Templates are NOT ported. Re-author markup as Tera under `assets/views/`. The new
+GUI may keep HTMX + Alpine + DaisyUI (still works with server-rendered Tera) or go
+a different direction — that is a GUI decision, not a backend one.
+
+### 3.4 OpenDAL → Loco storage
+
+Loco has its own `storage` abstraction (local, S3, multi-backend mirror/replica).
+Map the old `Storage`/`ImageStorage`/`AudioStorage` wrappers onto it. Default to
+local (`uploads/`); keep S3/Azure/GCS reachable via config only.
+
+### 3.5 Range requests for audio
+
+The old `stream_track` forwards the request so `ServeFile` honours `Range`
+headers (seeking/progressive playback). The Loco equivalent must also emit
+`Accept-Ranges`/`Content-Range` — use `tower-http` `ServeFile`/`ServeDir` or a
+range-aware handler. Do not regress this; it is required for the player's seek bar.
+
+---
+
+## 4. Database schema
+
+Old app: 8 migrations under `../migrations/`. Re-create as SeaORM migrations in
+`migration/src/` (the `loco new` scaffold already created `m20220101_000001_users`).
+Prefer Loco generators: `cargo loco generate model <name> ...`.
+
+### 4.1 `users`
+| column            | type         | notes                                  |
+|-------------------|--------------|----------------------------------------|
+| id                | UUID PK      | `gen_random_uuid()`                    |
+| email             | VARCHAR(255) | UNIQUE NOT NULL                        |
+| password_hash     | TEXT         | NOT NULL (argon2)                      |
+| email_verified    | BOOLEAN      | default FALSE                          |
+| email_verified_at | TIMESTAMPTZ  | nullable                               |
+| theme             | VARCHAR(10)  | default `'light'`                      |
+| created_at        | TIMESTAMPTZ  | default NOW                            |
+| updated_at        | TIMESTAMPTZ  | default NOW                            |
+
+> Loco's scaffold `users` table differs (has `pid`, `api_key`, reset/verification
+> token columns). Reconcile: either adopt Loco's columns and add `theme`, or align
+> Loco's model to this schema. Adopting Loco's is less work — it already wires
+> tokens for verification/reset.
+
+### 4.2 `email_verifications`
+`id UUID PK`, `user_id UUID FK→users ON DELETE CASCADE`, `token VARCHAR(255) UNIQUE`,
+`expires_at TIMESTAMPTZ`, `created_at TIMESTAMPTZ`. Indexes on `token`, `user_id`.
+> Loco's `users` table already carries verification tokens — this table may become
+> redundant if you adopt Loco's auth columns.
+
+### 4.3 `user_roles`
+`user_id UUID FK→users CASCADE`, `role VARCHAR(50)` (`user`|`moderator`|`admin`|
+`super_admin`), `assigned_by UUID FK→users ON DELETE SET NULL`, `assigned_at
+TIMESTAMPTZ`. **PK = (user_id, role).** Index on `user_id`. Migration back-fills
+`user` role for every existing user.
+
+### 4.4 `blog_articles`
+`id UUID PK`, `title VARCHAR(500)`, `slug VARCHAR(500) UNIQUE`, `content TEXT`,
+`excerpt VARCHAR(1000) NULL`, `published BOOL default false`, `author_id UUID
+FK→users CASCADE`, `featured_image_id VARCHAR(500) NULL`, `view_count INT default 0`,
+`created_at`, `updated_at` (trigger-updated), `published_at TIMESTAMPTZ NULL`.
+Indexes: `slug`, `(published, published_at DESC)`, `author_id`.
+
+### 4.5 `audit_logs`
+`id UUID PK`, `admin_user_id UUID FK→users CASCADE`, `action VARCHAR(100)`,
+`target_type VARCHAR(50) NULL`, `target_id UUID NULL`, `details JSONB NULL`,
+`ip_address INET NULL`, `user_agent TEXT NULL`, `created_at TIMESTAMPTZ`.
+Indexes: `admin_user_id`, `action`, `(target_type,target_id)`, `created_at DESC`.
+
+### 4.6 `audio_albums`
+`id UUID PK`, `title VARCHAR(500)`, `slug VARCHAR(500) UNIQUE`, `description TEXT
+NULL`, `cover_image_id VARCHAR(500) NULL`, `artist VARCHAR(500) NULL`, `release_date
+DATE NULL`, `published BOOL default false`, `uploader_id UUID FK→users CASCADE`,
+`view_count INT default 0`, `created_at`, `updated_at` (trigger), `published_at NULL`.
+Indexes: `slug`, `published`, `uploader_id`.
+
+### 4.7 `audio_tracks`
+`id UUID PK`, `album_id UUID FK→audio_albums CASCADE`, `title VARCHAR(500)`, `slug
+VARCHAR(500)`, `audio_file_id VARCHAR(500) NOT NULL`, `track_number INT NULL`,
+`duration INT NULL` (seconds), `featured BOOL default false`, `play_count INT
+default 0`, `created_at`, `updated_at` (trigger). **UNIQUE(album_id, slug).**
+
+### 4.8 `audio_tags` + `audio_track_tags`
+`audio_tags`: `id UUID PK`, `name VARCHAR(100) UNIQUE`, `slug VARCHAR(100) UNIQUE`,
+`created_at`. `audio_track_tags` (M:N junction): `track_id UUID FK→audio_tracks
+CASCADE`, `tag_id UUID FK→audio_tags CASCADE`, `created_at`, **PK=(track_id,tag_id)**.
+
+> The old schema uses `updated_at` triggers. SeaORM convention is to set
+> `updated_at` in the `ActiveModel` (`before_save` hook) instead — either works.
+
+---
+
+## 5. Routes (parity table)
+
+`method path → behaviour (auth requirement)`. Loco controllers live in
+`src/controllers/`; register each with `.add_route(...)` in `app.rs`.
+
+### Auth (`/auth`)
+- `GET  /auth/login` → login page (public)
+- `POST /auth/login` → login, HTML/HTMX response; sets session cookie
+- `POST /auth/login/json` → login, JSON response
+- `GET  /auth/register` → register page (public)
+- `POST /auth/register` → register, HTML/HTMX
+- `POST /auth/register/json` → register, JSON
+- `POST /auth/logout` → clear session
+- `GET  /auth/me` → current user (auth required)
+- `GET  /auth/verify?token=` → verify email
+- `POST /auth/verify/resend` → resend verification (auth required)
+
+### RBAC (`/rbac`)
+- `GET  /rbac/permissions` → list all permissions (public)
+- `GET  /rbac/roles` → list all roles (public)
+- `GET  /rbac/me` → current user roles+permissions (auth)
+- `GET  /rbac/users/{id}/roles` → (auth)
+- `GET  /rbac/users/{id}/permissions` → (auth)
+- `POST /rbac/users/{id}/roles` → assign role (SuperAdmin)
+- `DELETE /rbac/users/{id}/roles/{role}` → remove role (SuperAdmin)
+
+### Blog
+- `GET /blog` → published articles (public)
+- `GET /blog/{slug}` → article, increments `view_count` (public)
+- `GET /admin/blog` & `/admin/blog/articles` → admin list (Moderator+)
+- `GET|POST /admin/blog/articles/create` → create form / submit (Moderator+)
+- `GET|POST /admin/blog/articles/{id}/edit` → edit form / submit (Moderator+)
+- `GET /admin/blog/articles/{id}/delete` → delete (Moderator+)
+
+### Admin (`/admin`)
+- `GET /admin` → redirect to `/admin/dashboard`
+- `GET /admin/dashboard` → dashboard + system stats (Moderator+)
+- `GET /admin/users` & `/admin/users/list` → user list, filter+paginate (Admin+)
+- `GET /admin/users/{id}` → user detail (Admin+)
+- `GET /admin/users/{id}/roles` → roles form (Admin+)
+- `POST /admin/users/{id}/roles/assign` → assign (Admin+)
+- `POST /admin/users/{id}/roles/{role}/remove` → remove (Admin+)
+- `GET /admin/audit-logs` → audit log list (Moderator+)
+
+### Audio (public + admin)
+- `POST /audio/upload` → raw audio upload (auth)
+- `GET  /audio/stream/{filename}` → stream raw file, **range-aware** (public)
+- `GET  /audio/albums` → published albums (public)
+- `GET  /audio/albums/{slug}` → album + tracks (public)
+- `GET  /audio/tracks/{id}/stream` → stream track, **range-aware** (public)
+- `GET  /admin/audio/albums` → admin album list (Moderator+)
+- `GET|POST /admin/audio/albums/create` → (Moderator+)
+- `GET|POST /admin/audio/albums/{id}/edit` → (Moderator+)
+- `GET  /admin/audio/albums/{id}/delete` → (Moderator+)
+- `GET  /admin/audio/albums/{id}/tracks` → track list (Moderator+)
+- `GET  /admin/audio/albums/{id}/tracks/upload` → upload form (Moderator+)
+- `POST /admin/audio/albums/{id}/tracks/upload-file` → multipart upload, 50 MB (Moderator+)
+- `GET|POST /admin/audio/tracks/{id}/edit` → (Moderator+)
+- `GET  /admin/audio/tracks/{id}/delete` → (Moderator+)
+- `GET  /admin/audio/tags` → tag list (Moderator+)
+- `POST /admin/audio/tags` → create tag (Moderator+)
+
+### Images
+- `POST /images/upload` → upload, validate ext+MIME, max 10 MB (auth)
+- `GET  /images/serve/{filename}` → serve with MIME + cache headers (public)
+
+### Misc
+- `GET /` → home (public)
+- `GET /layout/navbar` → navbar fragment reflecting auth state (public)
+- `GET /theme` → current theme; `GET /theme/set?...` → set theme (public)
+- `GET /static/*` → static files
+- `GET /swagger-ui/`, `GET /api-docs/openapi.json` → API docs
+
+---
+
+## 6. Feature details
+
+### 6.1 Auth
+- Register: validate email + password (8–64 chars), reject duplicate email,
+  argon2-hash password, insert user, assign default `user` role.
+- Login: look up by email, verify password (constant-time), create session.
+- **Admin bootstrap:** on successful login, if `user.email` (case-insensitive)
+  equals config `admin_email`, assign `SuperAdmin` role (idempotent) and write an
+  `audit_logs` row with `action="admin_bootstrap"`. This is how the first admin is
+  created — there is no seed user. Keep this behaviour.
+- Email verification: token table + `email_verified`/`email_verified_at`. The old
+  app stored tokens but never emailed them — the Loco rewrite **should actually
+  send** the email via the scaffolded `mailers/auth`.
+- Every response that changes auth state should let the navbar refresh
+  (`GET /layout/navbar`).
+
+### 6.2 RBAC
+- **Roles:** `SuperAdmin`, `Admin` (same perms as SuperAdmin), `Moderator`, `User`.
+- **Permissions (~14):** `users.{create,read,update,delete,manage_roles}`,
+  `roles.assign`, `content.{create,read,update,delete,moderate}`,
+  `images.{create,read,update,delete}`.
+- Role→permission mapping:
+  - SuperAdmin / Admin → all permissions.
+  - Moderator → `content.read/update/moderate`, `users.read`, `images.read/delete`.
+  - User (default) → `content.read`, `images.create/read`.
+- A **middleware** loads the current user's `UserPermissions` into request
+  extensions on every request so handlers/views can check access. In Loco, do this
+  with a middleware layer or a custom extractor. Provide guard helpers equivalent
+  to "Moderator+", "Admin+", "SuperAdmin".
+
+### 6.3 Admin
+- Dashboard with system stats (user counts, content counts) — Moderator+.
+- User management: list with search filter + pagination, detail view — Admin+.
+- Role assign/remove per user, each writing an `audit_logs` entry — Admin+.
+- Audit log viewer — Moderator+.
+- `AuditLog` fields: action, target_type, target_id, JSONB details, ip_address,
+  user_agent. Populate IP + user-agent from request headers.
+
+### 6.4 Blog
+- Public: list published articles (paginate), view by slug (increments `view_count`).
+- Admin (Moderator+): create / edit / delete, draft↔publish (`published_at` set on
+  publish), drafts visible only in admin.
+- Slug auto-generated from title: lowercase, alphanumeric + hyphens, collapse
+  repeats; uniqueness enforced by DB — surface a clear "already exists" error.
+- `author_id` = current user. `featured_image_id` references an uploaded image id.
+
+### 6.5 Audio dashboard
+- **Albums:** CRUD, publish workflow, public list shows published only, slug URLs,
+  `cover_image_id` references an image, `view_count`.
+- **Tracks:** belong to an album, multipart upload (50 MB cap, extensions
+  `mp3 wav ogg flac aac m4a webm`), `track_number`, `duration` (seconds, nullable —
+  upload does not extract it; the player reads it from the audio element instead),
+  `featured`, `play_count`, slug unique per album.
+- **Tags:** create + assign to tracks (M:N). Tag has unique name + slug.
+
+### 6.6 Audio streaming & player
+- `stream_track` / `stream_handler` must honour `Range` requests (see §3.5).
+- The old app has a **persistent bottom-bar player** (`templates/player/player.html`):
+  hidden `<audio>` + Alpine.js, play/pause, prev/next, seek bar, volume persisted to
+  `localStorage`, auto-advance on track end. It is a sibling of the main content so
+  HTMX navigation never tears it down — music keeps playing across pages.
+- Pages drive it via one global JS API: `MusicPlayer.playQueue(containerSelector,
+  startIndex)`, reading `data-*` attributes off track rows (no JSON in markup).
+- This is a **frontend concern** — reproduce the behaviour in the new GUI; the
+  backend only needs the range-aware stream endpoints + track metadata.
+
+### 6.7 Images
+- Upload: multipart, validate extension (`jpg jpeg png webp gif`) and MIME, max
+  10 MB, store via storage backend, return a file id.
+- Serve: public, correct MIME (guessed from extension), long-cache headers.
+- Image ids are referenced by `blog_articles.featured_image_id` and
+  `audio_albums.cover_image_id` (stored as strings, not FKs).
+
+### 6.8 Theme
+- Per-user `theme` column (`light`/`dark`); also a cookie for anonymous users.
+- `GET /theme` returns current, `GET /theme/set` toggles/sets it.
+- Maps to DaisyUI themes in the old GUI (`winter`/`dracula`). New GUI decides its
+  own theming, but keep the per-user persisted preference.
+
+### 6.9 Storage
+- Default backend: local filesystem under `uploads/` (`uploads/images`,
+  `uploads/audio`). Keep S3/Azure/GCS reachable via config only.
+- Path-traversal protection on every user-supplied filename/path.
+- Use Loco's `storage` module; configure backends in `config/*.yaml`.
+
+---
+
+## 7. Configuration / env
+
+Old `.env`:
+```
+DATABASE_URL=postgres://uni_web_user:1@localhost/universal_web
+ADMIN_EMAIL=filippriec@gmail.com
+```
+In Loco, move these into `config/development.yaml` (DB url under `database:`) and
+add a custom `settings:` entry for `admin_email` (read via `ctx.config.settings`).
+The old default bind address is `0.0.0.0:3000` — set under `server:` in the yaml.
+
+---
+
+## 8. What the Loco scaffold already gives you
+
+Already generated in this directory — reuse, don't rebuild:
+- `src/controllers/auth.rs` — register / login / verify / forgot / reset endpoints.
+- `src/models/users.rs` + `_entities/users.rs` — user model with password hashing.
+- `src/mailers/auth/` — welcome / forgot-password / magic-link email templates.
+- `src/workers/downloader.rs` — example background worker (bg mode = `async`).
+- `src/initializers/view_engine.rs` — Tera view engine + i18n wiring.
+- `migration/` — SeaORM migration crate.
+- `config/{development,production,test}.yaml` — config files.
+
+---
+
+## 9. Suggested implementation order
+
+1. **DB & models** — port all 8 tables as SeaORM migrations; `cargo loco db
+   entities`; reconcile `users` with the scaffold (§4.1).
+2. **Auth + sessions** — settle §3.1, get register/login/logout/me working,
+   including admin-bootstrap.
+3. **RBAC** — roles/permissions, the permission-loading middleware, guard helpers.
+4. **Storage + images** — storage backend, image upload/serve (unblocks blog/audio
+   cover images).
+5. **Blog** — CRUD + publish + public pages.
+6. **Audio dashboard** — albums, tracks (multipart upload), tags.
+7. **Audio streaming + player** — range-aware endpoints, then the player in the GUI.
+8. **Admin** — dashboard, user management, role UI, audit log.
+9. **Theme**, **home/layout/navbar**.
+10. **Swagger/OpenAPI** (optional), tests, polish.
+
+---
+
+## 10. Testing
+
+The old app has 19 tests (17 integration hitting a live server + 2 multipart
+upload) plus unit tests; see `../TESTING.md`. Loco has a first-class testing story
+(`#[tokio::test]` + `loco-rs` testing feature, `serial_test`, `insta` snapshots —
+all already dev-deps). Re-create integration coverage for every route in §5,
+especially: public pages return 200, protected routes return 401/403 without auth,
+multipart uploads, and range requests on the streaming endpoints.
+
+---
+
+## 11. Notes / known quirks carried over
+
+- Track `duration` is frequently `NULL` (upload never extracts it). The player
+  reads duration from the `<audio>` element's metadata, so the seek bar works
+  anyway — don't block on server-side duration extraction.
+- `Admin` and `SuperAdmin` have identical permission sets; only role-assignment
+  endpoints are SuperAdmin-gated.
+- Image references (`featured_image_id`, `cover_image_id`) are plain strings, not
+  foreign keys — the rewrite may upgrade these to real FKs if desired.
--- a/assets/i18n/de-DE/main.ftl
+++ b/assets/i18n/de-DE/main.ftl
@@ -0,0 +1,4 @@
+hello-world = Hallo Welt!
+greeting = Hallochen { $name }!
+        .placeholder = Hallo Freund!
+about = Uber
--- a/assets/i18n/en-US/main.ftl
+++ b/assets/i18n/en-US/main.ftl
@@ -0,0 +1,10 @@
+hello-world = Hello World!
+greeting = Hello { $name }!
+        .placeholder = Hello Friend!
+about = About
+simple = simple text
+reference = simple text with a reference: { -something }
+parameter = text with a { $param }
+parameter2 = text one { $param } second { $multi-word-param }
+email = text with an EMAIL("example@example.org")
+fallback = this should fall back
--- a/assets/i18n/shared.ftl
+++ b/assets/i18n/shared.ftl
@@ -0,0 +1 @@
+-something = foo
--- a/assets/static/404.html
+++ b/assets/static/404.html
@@ -0,0 +1,3 @@
+<html><body>
+not found :-(
+</body></html>
--- a/assets/static/image.png
+++ b/assets/static/image.png
--- a/assets/views/home/hello.html
+++ b/assets/views/home/hello.html
@@ -0,0 +1,12 @@
+<html><body>
+  <img src="/static/image.png" width="200"/>
+  <br/>
+  find this tera template at <code>assets/views/home/hello.html</code>: 
+  <br/>
+  <br/>
+  {{ t(key="hello-world", lang="en-US") }}, 
+  <br/>
+  {{ t(key="hello-world", lang="de-DE") }}
+  
+</body></html>
+  
--- a/config/development.yaml
+++ b/config/development.yaml
@@ -0,0 +1,99 @@
+# Loco configuration file documentation
+
+# Application logging configuration
+logger:
+  # Enable or disable logging.
+  enable: true
+  # Enable pretty backtrace (sets RUST_BACKTRACE=1)
+  pretty_backtrace: true
+  # Log level, options: trace, debug, info, warn or error.
+  level: debug
+  # Define the logging format. options: compact, pretty or json
+  format: compact
+  # By default the logger has filtering only logs that came from your code or logs that came from `loco` framework. to see all third party libraries
+  # Uncomment the line below to override to see all third party libraries you can enable this config and override the logger filters.
+  # override_filter: trace
+
+# Web server configuration
+server:
+  # Port on which the server will listen. the server binding is 0.0.0.0:{PORT}
+  port: 5150
+  # Binding for the server (which interface to bind to)
+  binding: localhost
+  # The UI hostname or IP address that mailers will point to.
+  host: http://localhost
+  # Out of the box middleware configuration. to disable middleware you can changed the `enable` field to `false` of comment the middleware block
+  middlewares:
+    static:
+      enable: true
+      must_exist: true
+      precompressed: false
+      folder:
+        uri: "/static"
+        path: "assets/static"
+      fallback: "assets/static/404.html"
+
+# Worker Configuration
+workers:
+  # specifies the worker mode. Options:
+  #   - BackgroundQueue - Workers operate asynchronously in the background, processing queued.
+  #   - ForegroundBlocking - Workers operate in the foreground and block until tasks are completed.
+  #   - BackgroundAsync - Workers operate asynchronously in the background, processing tasks with async capabilities.
+  mode: BackgroundAsync
+
+  
+
+# Mailer Configuration.
+mailer:
+  # SMTP mailer configuration.
+  smtp:
+    # Enable/Disable smtp mailer.
+    enable: true
+    # SMTP server host. e.x localhost, smtp.gmail.com
+    host: localhost
+    # SMTP server port
+    port: 1025
+    # Use secure connection (SSL/TLS).
+    secure: false
+    # auth:
+    #   user:
+    #   password:
+    # Override the SMTP hello name (default is the machine's hostname)
+    # hello_name:
+
+# Initializers Configuration
+# initializers:
+#  oauth2:
+#    authorization_code: # Authorization code grant type
+#      - client_identifier: google # Identifier for the OAuth2 provider. Replace 'google' with your provider's name if different, must be unique within the oauth2 config.
+#        ... other fields
+
+# Database Configuration
+database:
+  # Database connection URI
+  uri: {{ get_env(name="DATABASE_URL", default="postgres://loco:loco@localhost:5432/universal_web_development") }}
+  # When enabled, the sql query will be logged.
+  enable_logging: false
+  # Set the timeout duration when acquiring a connection.
+  connect_timeout: {{ get_env(name="DB_CONNECT_TIMEOUT", default="500") }}
+  # Set the idle duration before closing a connection.
+  idle_timeout: {{ get_env(name="DB_IDLE_TIMEOUT", default="500") }}
+  # Minimum number of connections for a pool.
+  min_connections: {{ get_env(name="DB_MIN_CONNECTIONS", default="1") }}
+  # Maximum number of connections for a pool.
+  max_connections: {{ get_env(name="DB_MAX_CONNECTIONS", default="1") }}
+  # Run migration up when application loaded
+  auto_migrate: true
+  # Truncate database when application loaded. This is a dangerous operation, make sure that you using this flag only on dev environments or test mode
+  dangerously_truncate: false
+  # Recreating schema when application loaded.  This is a dangerous operation, make sure that you using this flag only on dev environments or test mode
+  dangerously_recreate: false
+
+# Authentication Configuration
+auth:
+  # JWT authentication
+  jwt:
+    # Secret key for token generation and verification
+    secret: A6ECni63rt2Jb00tX9Hf
+    # Token expiration time in seconds
+    expiration: 604800 # 7 days
--- a/config/test.yaml
+++ b/config/test.yaml
@@ -0,0 +1,96 @@
+# Loco configuration file documentation
+
+# Application logging configuration
+logger:
+  # Enable or disable logging.
+  enable: false
+  # Enable pretty backtrace (sets RUST_BACKTRACE=1)
+  pretty_backtrace: true
+  # Log level, options: trace, debug, info, warn or error.
+  level: debug
+  # Define the logging format. options: compact, pretty or json
+  format: compact
+  # By default the logger has filtering only logs that came from your code or logs that came from `loco` framework. to see all third party libraries
+  # Uncomment the line below to override to see all third party libraries you can enable this config and override the logger filters.
+  # override_filter: trace
+
+# Web server configuration
+server:
+  # Port on which the server will listen. the server binding is 0.0.0.0:{PORT}
+  port: 5150
+  # The UI hostname or IP address that mailers will point to.
+  host: http://localhost
+  # Out of the box middleware configuration. to disable middleware you can changed the `enable` field to `false` of comment the middleware block
+  middlewares: 
+    static:
+      enable: true
+      must_exist: true
+      precompressed: false
+      folder:
+        uri: "/static"
+        path: "assets/static"
+      fallback: "assets/static/404.html"
+
+# Worker Configuration
+workers:
+  # specifies the worker mode. Options:
+  #   - BackgroundQueue - Workers operate asynchronously in the background, processing queued.
+  #   - ForegroundBlocking - Workers operate in the foreground and block until tasks are completed.
+  #   - BackgroundAsync - Workers operate asynchronously in the background, processing tasks with async capabilities.
+  mode: ForegroundBlocking
+
+  
+
+# Mailer Configuration.
+mailer:
+  stub: true
+  # SMTP mailer configuration.
+  smtp:
+    # Enable/Disable smtp mailer.
+    enable: true
+    # SMTP server host. e.x localhost, smtp.gmail.com
+    host: localhost
+    # SMTP server port
+    port: 1025
+    # Use secure connection (SSL/TLS).
+    secure: false
+    # auth:
+    #   user:
+    #   password:
+
+# Initializers Configuration
+# initializers:
+#  oauth2:
+#    authorization_code: # Authorization code grant type
+#      - client_identifier: google # Identifier for the OAuth2 provider. Replace 'google' with your provider's name if different, must be unique within the oauth2 config.
+#        ... other fields
+
+# Database Configuration
+database:
+  # Database connection URI
+  uri: {{ get_env(name="DATABASE_URL", default="postgres://loco:loco@localhost:5432/universal_web_test") }}
+  # When enabled, the sql query will be logged.
+  enable_logging: false
+  # Set the timeout duration when acquiring a connection.
+  connect_timeout: {{ get_env(name="DB_CONNECT_TIMEOUT", default="500") }}
+  # Set the idle duration before closing a connection.
+  idle_timeout: {{ get_env(name="DB_IDLE_TIMEOUT", default="500") }}
+  # Minimum number of connections for a pool.
+  min_connections: {{ get_env(name="DB_MIN_CONNECTIONS", default="1") }}
+  # Maximum number of connections for a pool.
+  max_connections: {{ get_env(name="DB_MAX_CONNECTIONS", default="1") }}
+  # Run migration up when application loaded
+  auto_migrate: true
+  # Truncate database when application loaded. This is a dangerous operation, make sure that you using this flag only on dev environments or test mode
+  dangerously_truncate: true
+  # Recreating schema when application loaded.  This is a dangerous operation, make sure that you using this flag only on dev environments or test mode
+  dangerously_recreate: true
+
+# Authentication Configuration
+auth:
+  # JWT authentication
+  jwt:
+    # Secret key for token generation and verification
+    secret: 0yWwoflcGiAhonIzhQyQ
+    # Token expiration time in seconds
+    expiration: 604800 # 7 days
--- a/examples/playground.rs
+++ b/examples/playground.rs
@@ -0,0 +1,21 @@
+#[allow(unused_imports)]
+use loco_rs::{cli::playground, prelude::*};
+use universal_web::app::App;
+
+#[tokio::main]
+async fn main() -> loco_rs::Result<()> {
+    let _ctx = playground::<App>().await?;
+
+    // let active_model: articles::ActiveModel = articles::ActiveModel {
+    //     title: Set(Some("how to build apps in 3 steps".to_string())),
+    //     content: Set(Some("use Loco: https://loco.rs".to_string())),
+    //     ..Default::default()
+    // };
+    // active_model.insert(&ctx.db).await.unwrap();
+
+    // let res = articles::Entity::find().all(&ctx.db).await.unwrap();
+    // println!("{:?}", res);
+    println!("welcome to playground. edit me at `examples/playground.rs`");
+
+    Ok(())
+}
--- a/migration/Cargo.toml
+++ b/migration/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "migration"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[lib]
+name = "migration"
+path = "src/lib.rs"
+
+[dependencies]
+loco-rs = { workspace = true }
+
+
+[dependencies.sea-orm-migration]
+version = "1.1.0"
+features = [
+  # Enable at least one `ASYNC_RUNTIME` and `DATABASE_DRIVER` feature if you want to run migration via CLI.
+  # View the list of supported features at https://www.sea-ql.org/SeaORM/docs/install-and-config/database-and-async-runtime.
+  # e.g.
+  "runtime-tokio-rustls", # `ASYNC_RUNTIME` feature
+]
--- a/migration/src/lib.rs
+++ b/migration/src/lib.rs
@@ -0,0 +1,16 @@
+#![allow(elided_lifetimes_in_paths)]
+#![allow(clippy::wildcard_imports)]
+pub use sea_orm_migration::prelude::*;
+mod m20220101_000001_users;
+
+pub struct Migrator;
+
+#[async_trait::async_trait]
+impl MigratorTrait for Migrator {
+    fn migrations() -> Vec<Box<dyn MigrationTrait>> {
+        vec![
+            Box::new(m20220101_000001_users::Migration),
+            // inject-above (do not remove this comment)
+        ]
+    }
+}
--- a/migration/src/m20220101_000001_users.rs
+++ b/migration/src/m20220101_000001_users.rs
@@ -0,0 +1,41 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        create_table(
+            m,
+            "users",
+            &[
+                ("id", ColType::PkAuto),
+                ("pid", ColType::Uuid),
+                ("email", ColType::StringUniq),
+                ("password", ColType::String),
+                ("api_key", ColType::StringUniq),
+                ("name", ColType::String),
+                ("reset_token", ColType::StringNull),
+                ("reset_sent_at", ColType::TimestampWithTimeZoneNull),
+                ("email_verification_token", ColType::StringNull),
+                (
+                    "email_verification_sent_at",
+                    ColType::TimestampWithTimeZoneNull,
+                ),
+                ("email_verified_at", ColType::TimestampWithTimeZoneNull),
+                ("magic_link_token", ColType::StringNull),
+                ("magic_link_expiration", ColType::TimestampWithTimeZoneNull),
+            ],
+            &[],
+        )
+        .await?;
+        Ok(())
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        drop_table(m, "users").await?;
+        Ok(())
+    }
+}
--- a/src/app.rs
+++ b/src/app.rs
@@ -0,0 +1,74 @@
+use async_trait::async_trait;
+use loco_rs::{
+    app::{AppContext, Hooks, Initializer},
+    bgworker::{BackgroundWorker, Queue},
+    boot::{create_app, BootResult, StartMode},
+    config::Config,
+    controller::AppRoutes,
+    db::{self, truncate_table},
+    environment::Environment,
+    task::Tasks,
+    Result,
+};
+use migration::Migrator;
+use std::path::Path;
+
+#[allow(unused_imports)]
+use crate::{
+    controllers, initializers, models::_entities::users, tasks, workers::downloader::DownloadWorker,
+};
+
+pub struct App;
+#[async_trait]
+impl Hooks for App {
+    fn app_name() -> &'static str {
+        env!("CARGO_CRATE_NAME")
+    }
+
+    fn app_version() -> String {
+        format!(
+            "{} ({})",
+            env!("CARGO_PKG_VERSION"),
+            option_env!("BUILD_SHA")
+                .or(option_env!("GITHUB_SHA"))
+                .unwrap_or("dev")
+        )
+    }
+
+    async fn boot(
+        mode: StartMode,
+        environment: &Environment,
+        config: Config,
+    ) -> Result<BootResult> {
+        create_app::<Self, Migrator>(mode, environment, config).await
+    }
+
+    async fn initializers(_ctx: &AppContext) -> Result<Vec<Box<dyn Initializer>>> {
+        Ok(vec![Box::new(
+            initializers::view_engine::ViewEngineInitializer,
+        )])
+    }
+
+    fn routes(_ctx: &AppContext) -> AppRoutes {
+        AppRoutes::with_default_routes() // controller routes below
+            .add_route(controllers::auth::routes())
+    }
+    async fn connect_workers(ctx: &AppContext, queue: &Queue) -> Result<()> {
+        queue.register(DownloadWorker::build(ctx)).await?;
+        Ok(())
+    }
+
+    #[allow(unused_variables)]
+    fn register_tasks(tasks: &mut Tasks) {
+        // tasks-inject (do not remove)
+    }
+    async fn truncate(ctx: &AppContext) -> Result<()> {
+        truncate_table(&ctx.db, users::Entity).await?;
+        Ok(())
+    }
+    async fn seed(ctx: &AppContext, base: &Path) -> Result<()> {
+        db::seed::<users::ActiveModel>(&ctx.db, &base.join("users.yaml").display().to_string())
+            .await?;
+        Ok(())
+    }
+}
--- a/src/bin/main.rs
+++ b/src/bin/main.rs
@@ -0,0 +1,8 @@
+use loco_rs::cli;
+use migration::Migrator;
+use universal_web::app::App;
+
+#[tokio::main]
+async fn main() -> loco_rs::Result<()> {
+    cli::main::<App, Migrator>().await
+}
--- a/src/controllers/auth.rs
+++ b/src/controllers/auth.rs
@@ -0,0 +1,273 @@
+use crate::{
+    mailers::auth::AuthMailer,
+    models::{
+        _entities::users,
+        users::{LoginParams, RegisterParams},
+    },
+    views::auth::{CurrentResponse, LoginResponse},
+};
+use loco_rs::prelude::*;
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::sync::OnceLock;
+
+pub static EMAIL_DOMAIN_RE: OnceLock<Regex> = OnceLock::new();
+
+fn get_allow_email_domain_re() -> &'static Regex {
+    EMAIL_DOMAIN_RE.get_or_init(|| {
+        Regex::new(r"@example\.com$|@gmail\.com$").expect("Failed to compile regex")
+    })
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ForgotParams {
+    pub email: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResetParams {
+    pub token: String,
+    pub password: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct MagicLinkParams {
+    pub email: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ResendVerificationParams {
+    pub email: String,
+}
+
+/// Register function creates a new user with the given parameters and sends a
+/// welcome email to the user
+#[debug_handler]
+async fn register(
+    State(ctx): State<AppContext>,
+    Json(params): Json<RegisterParams>,
+) -> Result<Response> {
+    let res = users::Model::create_with_password(&ctx.db, &params).await;
+
+    let user = match res {
+        Ok(user) => user,
+        Err(err) => {
+            tracing::info!(
+                message = err.to_string(),
+                user_email = &params.email,
+                "could not register user",
+            );
+            return format::json(());
+        }
+    };
+
+    let user = user
+        .into_active_model()
+        .set_email_verification_sent(&ctx.db)
+        .await?;
+
+    AuthMailer::send_welcome(&ctx, &user).await?;
+
+    format::json(())
+}
+
+/// Verify register user. if the user not verified his email, he can't login to
+/// the system.
+#[debug_handler]
+async fn verify(State(ctx): State<AppContext>, Path(token): Path<String>) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_verification_token(&ctx.db, &token).await else {
+        return unauthorized("invalid token");
+    };
+
+    if user.email_verified_at.is_some() {
+        tracing::info!(pid = user.pid.to_string(), "user already verified");
+    } else {
+        let active_model = user.into_active_model();
+        let user = active_model.verified(&ctx.db).await?;
+        tracing::info!(pid = user.pid.to_string(), "user verified");
+    }
+
+    format::json(())
+}
+
+/// In case the user forgot his password  this endpoints generate a forgot token
+/// and send email to the user. In case the email not found in our DB, we are
+/// returning a valid request for for security reasons (not exposing users DB
+/// list).
+#[debug_handler]
+async fn forgot(
+    State(ctx): State<AppContext>,
+    Json(params): Json<ForgotParams>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
+        // we don't want to expose our users email. if the email is invalid we still
+        // returning success to the caller
+        return format::json(());
+    };
+
+    let user = user
+        .into_active_model()
+        .set_forgot_password_sent(&ctx.db)
+        .await?;
+
+    AuthMailer::forgot_password(&ctx, &user).await?;
+
+    format::json(())
+}
+
+/// reset user password by the given parameters
+#[debug_handler]
+async fn reset(State(ctx): State<AppContext>, Json(params): Json<ResetParams>) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_reset_token(&ctx.db, &params.token).await else {
+        // we don't want to expose our users email. if the email is invalid we still
+        // returning success to the caller
+        tracing::info!("reset token not found");
+
+        return format::json(());
+    };
+    user.into_active_model()
+        .reset_password(&ctx.db, &params.password)
+        .await?;
+
+    format::json(())
+}
+
+/// Creates a user login and returns a token
+#[debug_handler]
+async fn login(State(ctx): State<AppContext>, Json(params): Json<LoginParams>) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
+        tracing::debug!(
+            email = params.email,
+            "login attempt with non-existent email"
+        );
+        return unauthorized("Invalid credentials!");
+    };
+
+    let valid = user.verify_password(&params.password);
+
+    if !valid {
+        return unauthorized("unauthorized!");
+    }
+
+    let jwt_secret = ctx.config.get_jwt_config()?;
+
+    let token = user
+        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
+        .or_else(|_| unauthorized("unauthorized!"))?;
+
+    format::json(LoginResponse::new(&user, &token))
+}
+
+#[debug_handler]
+async fn current(auth: auth::JWT, State(ctx): State<AppContext>) -> Result<Response> {
+    let user = users::Model::find_by_pid(&ctx.db, &auth.claims.pid).await?;
+    format::json(CurrentResponse::new(&user))
+}
+
+/// Magic link authentication provides a secure and passwordless way to log in to the application.
+///
+/// # Flow
+/// 1. **Request a Magic Link**:
+///    A registered user sends a POST request to `/magic-link` with their email.
+///    If the email exists, a short-lived, one-time-use token is generated and sent to the user's email.
+///    For security and to avoid exposing whether an email exists, the response always returns 200, even if the email is invalid.
+///
+/// 2. **Click the Magic Link**:
+///    The user clicks the link (/magic-link/{token}), which validates the token and its expiration.
+///    If valid, the server generates a JWT and responds with a [`LoginResponse`].
+///    If invalid or expired, an unauthorized response is returned.
+///
+/// This flow enhances security by avoiding traditional passwords and providing a seamless login experience.
+async fn magic_link(
+    State(ctx): State<AppContext>,
+    Json(params): Json<MagicLinkParams>,
+) -> Result<Response> {
+    let email_regex = get_allow_email_domain_re();
+    if !email_regex.is_match(&params.email) {
+        tracing::debug!(
+            email = params.email,
+            "The provided email is invalid or does not match the allowed domains"
+        );
+        return bad_request("invalid request");
+    }
+
+    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
+        // we don't want to expose our users email. if the email is invalid we still
+        // returning success to the caller
+        tracing::debug!(email = params.email, "user not found by email");
+        return format::empty_json();
+    };
+
+    let user = user.into_active_model().create_magic_link(&ctx.db).await?;
+    AuthMailer::send_magic_link(&ctx, &user).await?;
+
+    format::empty_json()
+}
+
+/// Verifies a magic link token and authenticates the user.
+async fn magic_link_verify(
+    Path(token): Path<String>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_magic_token(&ctx.db, &token).await else {
+        // we don't want to expose our users email. if the email is invalid we still
+        // returning success to the caller
+        return unauthorized("unauthorized!");
+    };
+
+    let user = user.into_active_model().clear_magic_link(&ctx.db).await?;
+
+    let jwt_secret = ctx.config.get_jwt_config()?;
+
+    let token = user
+        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
+        .or_else(|_| unauthorized("unauthorized!"))?;
+
+    format::json(LoginResponse::new(&user, &token))
+}
+
+#[debug_handler]
+async fn resend_verification_email(
+    State(ctx): State<AppContext>,
+    Json(params): Json<ResendVerificationParams>,
+) -> Result<Response> {
+    let Ok(user) = users::Model::find_by_email(&ctx.db, &params.email).await else {
+        tracing::info!(
+            email = params.email,
+            "User not found for resend verification"
+        );
+        return format::json(());
+    };
+
+    if user.email_verified_at.is_some() {
+        tracing::info!(
+            pid = user.pid.to_string(),
+            "User already verified, skipping resend"
+        );
+        return format::json(());
+    }
+
+    let user = user
+        .into_active_model()
+        .set_email_verification_sent(&ctx.db)
+        .await?;
+
+    AuthMailer::send_welcome(&ctx, &user).await?;
+    tracing::info!(pid = user.pid.to_string(), "Verification email re-sent");
+
+    format::json(())
+}
+
+pub fn routes() -> Routes {
+    Routes::new()
+        .prefix("/api/auth")
+        .add("/register", post(register))
+        .add("/verify/{token}", get(verify))
+        .add("/login", post(login))
+        .add("/forgot", post(forgot))
+        .add("/reset", post(reset))
+        .add("/current", get(current))
+        .add("/magic-link", post(magic_link))
+        .add("/magic-link/{token}", get(magic_link_verify))
+        .add("/resend-verification-mail", post(resend_verification_email))
+}
--- a/src/controllers/mod.rs
+++ b/src/controllers/mod.rs
@@ -0,0 +1 @@
+pub mod auth;
--- a/src/data/mod.rs
+++ b/src/data/mod.rs
@@ -0,0 +1 @@
+
--- a/src/fixtures/users.yaml
+++ b/src/fixtures/users.yaml
@@ -0,0 +1,17 @@
+---
+- id: 1
+  pid: 11111111-1111-1111-1111-111111111111
+  email: user1@example.com
+  password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc"
+  api_key: lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758
+  name: user1
+  created_at: "2023-11-12T12:34:56.789Z"
+  updated_at: "2023-11-12T12:34:56.789Z"
+- id: 2
+  pid: 22222222-2222-2222-2222-222222222222
+  email: user2@example.com
+  password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc"
+  api_key: lo-153561ca-fa84-4e1b-813a-c62526d0a77e
+  name: user2
+  created_at: "2023-11-12T12:34:56.789Z"
+  updated_at: "2023-11-12T12:34:56.789Z"
--- a/src/initializers/mod.rs
+++ b/src/initializers/mod.rs
@@ -0,0 +1 @@
+pub mod view_engine;
--- a/src/initializers/view_engine.rs
+++ b/src/initializers/view_engine.rs
@@ -0,0 +1,43 @@
+use async_trait::async_trait;
+use axum::{Extension, Router as AxumRouter};
+use fluent_templates::{ArcLoader, FluentLoader};
+use loco_rs::{
+    app::{AppContext, Initializer},
+    controller::views::{engines, ViewEngine},
+    Error, Result,
+};
+use tracing::info;
+
+const I18N_DIR: &str = "assets/i18n";
+const I18N_SHARED: &str = "assets/i18n/shared.ftl";
+#[allow(clippy::module_name_repetitions)]
+pub struct ViewEngineInitializer;
+
+#[async_trait]
+impl Initializer for ViewEngineInitializer {
+    fn name(&self) -> String {
+        "view-engine".to_string()
+    }
+
+    async fn after_routes(&self, router: AxumRouter, _ctx: &AppContext) -> Result<AxumRouter> {
+        let tera_engine = if std::path::Path::new(I18N_DIR).exists() {
+            let arc = std::sync::Arc::new(
+                ArcLoader::builder(&I18N_DIR, unic_langid::langid!("en-US"))
+                    .shared_resources(Some(&[I18N_SHARED.into()]))
+                    .customize(|bundle| bundle.set_use_isolating(false))
+                    .build()
+                    .map_err(|e| Error::string(&e.to_string()))?,
+            );
+            info!("locales loaded");
+
+            engines::TeraView::build()?.post_process(move |tera| {
+                tera.register_function("t", FluentLoader::new(arc.clone()));
+                Ok(())
+            })?
+        } else {
+            engines::TeraView::build()?
+        };
+
+        Ok(router.layer(Extension(ViewEngine::from(tera_engine))))
+    }
+}
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -0,0 +1,9 @@
+pub mod app;
+pub mod controllers;
+pub mod data;
+pub mod initializers;
+pub mod mailers;
+pub mod models;
+pub mod tasks;
+pub mod views;
+pub mod workers;
--- a/src/mailers/auth.rs
+++ b/src/mailers/auth.rs
@@ -0,0 +1,90 @@
+// auth mailer
+#![allow(non_upper_case_globals)]
+
+use loco_rs::prelude::*;
+use serde_json::json;
+
+use crate::models::users;
+
+static welcome: Dir<'_> = include_dir!("src/mailers/auth/welcome");
+static forgot: Dir<'_> = include_dir!("src/mailers/auth/forgot");
+static magic_link: Dir<'_> = include_dir!("src/mailers/auth/magic_link");
+
+#[allow(clippy::module_name_repetitions)]
+pub struct AuthMailer {}
+impl Mailer for AuthMailer {}
+impl AuthMailer {
+    /// Sending welcome email the the given user
+    ///
+    /// # Errors
+    ///
+    /// When email sending is failed
+    pub async fn send_welcome(ctx: &AppContext, user: &users::Model) -> Result<()> {
+        Self::mail_template(
+            ctx,
+            &welcome,
+            mailer::Args {
+                to: user.email.to_string(),
+                locals: json!({
+                  "name": user.name,
+                  "verifyToken": user.email_verification_token,
+                  "domain": ctx.config.server.full_url()
+                }),
+                ..Default::default()
+            },
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    /// Sending forgot password email
+    ///
+    /// # Errors
+    ///
+    /// When email sending is failed
+    pub async fn forgot_password(ctx: &AppContext, user: &users::Model) -> Result<()> {
+        Self::mail_template(
+            ctx,
+            &forgot,
+            mailer::Args {
+                to: user.email.to_string(),
+                locals: json!({
+                  "name": user.name,
+                  "resetToken": user.reset_token,
+                  "domain": ctx.config.server.full_url()
+                }),
+                ..Default::default()
+            },
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    /// Sends a magic link authentication email to the user.
+    ///
+    /// # Errors
+    ///
+    /// When email sending is failed
+    pub async fn send_magic_link(ctx: &AppContext, user: &users::Model) -> Result<()> {
+        Self::mail_template(
+            ctx,
+            &magic_link,
+            mailer::Args {
+                to: user.email.to_string(),
+                locals: json!({
+                  "name": user.name,
+                  "token": user.magic_link_token.clone().ok_or_else(|| Error::string(
+                            "the user model not contains magic link token",
+                    ))?,
+                  "host": ctx.config.server.full_url()
+                }),
+                ..Default::default()
+            },
+        )
+        .await?;
+
+        Ok(())
+    }
+}
--- a/src/mailers/auth/forgot/html.t
+++ b/src/mailers/auth/forgot/html.t
@@ -0,0 +1,11 @@
+;<html>
+
+<body>
+  Hey {{name}},
+  Forgot your password? No worries! You can reset it by clicking the link below:
+  <a href="http://{{domain}}/reset#{{resetToken}}">Reset Your Password</a>
+  If you didn't request a password reset, please ignore this email.
+  Best regards,<br>The Loco Team</br>
+</body>
+
+</html>
--- a/src/mailers/auth/forgot/subject.t
+++ b/src/mailers/auth/forgot/subject.t
@@ -0,0 +1 @@
+Your reset password link
--- a/src/mailers/auth/forgot/text.t
+++ b/src/mailers/auth/forgot/text.t
@@ -0,0 +1,3 @@
+Reset your password with this link:
+
+http://localhost/reset#{{resetToken}}
--- a/src/mailers/auth/magic_link/html.t
+++ b/src/mailers/auth/magic_link/html.t
@@ -0,0 +1,8 @@
+;<html>
+<body>
+<p>Magic link example:</p>
+<a href="{{host}}/api/auth/magic-link/{{token}}">
+Verify Your Account
+</a>
+</body>
+</html>
--- a/src/mailers/auth/magic_link/subject.t
+++ b/src/mailers/auth/magic_link/subject.t
@@ -0,0 +1 @@
+Magic link example
--- a/src/mailers/auth/magic_link/text.t
+++ b/src/mailers/auth/magic_link/text.t
@@ -0,0 +1,2 @@
+Magic link with this link: 
+{{host}}/api/auth/magic-link/{{token}}
--- a/src/mailers/auth/welcome/html.t
+++ b/src/mailers/auth/welcome/html.t
@@ -0,0 +1,13 @@
+;<html>
+
+<body>
+  Dear {{name}},
+  Welcome to Loco! You can now log in to your account.
+  Before you get started, please verify your account by clicking the link below:
+  <a href="{{domain}}/api/auth/verify/{{verifyToken}}">
+    Verify Your Account
+  </a>
+  <p>Best regards,<br>The Loco Team</p>
+</body>
+
+</html>
--- a/src/mailers/auth/welcome/subject.t
+++ b/src/mailers/auth/welcome/subject.t
@@ -0,0 +1 @@
+Welcome {{name}}
--- a/src/mailers/auth/welcome/text.t
+++ b/src/mailers/auth/welcome/text.t
@@ -0,0 +1,4 @@
+Welcome {{name}}, you can now log in.
+  Verify your account with the link below:
+
+  {{domain}}/api/auth/verify/{{verifyToken}}
--- a/src/mailers/mod.rs
+++ b/src/mailers/mod.rs
@@ -0,0 +1 @@
+pub mod auth;
--- a/src/models/_entities/mod.rs
+++ b/src/models/_entities/mod.rs
@@ -0,0 +1,4 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.0.0
+
+pub mod prelude;
+pub mod users;
--- a/src/models/_entities/prelude.rs
+++ b/src/models/_entities/prelude.rs
@@ -0,0 +1,2 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.0.0
+pub use super::users::Entity as Users;
--- a/src/models/_entities/users.rs
+++ b/src/models/_entities/users.rs
@@ -0,0 +1,30 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.0.0
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "users")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub pid: Uuid,
+    #[sea_orm(unique)]
+    pub email: String,
+    pub password: String,
+    #[sea_orm(unique)]
+    pub api_key: String,
+    pub name: String,
+    pub reset_token: Option<String>,
+    pub reset_sent_at: Option<DateTimeWithTimeZone>,
+    pub email_verification_token: Option<String>,
+    pub email_verification_sent_at: Option<DateTimeWithTimeZone>,
+    pub email_verified_at: Option<DateTimeWithTimeZone>,
+    pub magic_link_token: Option<String>,
+    pub magic_link_expiration: Option<DateTimeWithTimeZone>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
--- a/src/models/mod.rs
+++ b/src/models/mod.rs
@@ -0,0 +1,2 @@
+pub mod _entities;
+pub mod users;
--- a/src/models/users.rs
+++ b/src/models/users.rs
@@ -0,0 +1,369 @@
+use async_trait::async_trait;
+use chrono::{offset::Local, Duration};
+use loco_rs::{auth::jwt, hash, prelude::*};
+use serde::{Deserialize, Serialize};
+use serde_json::Map;
+use uuid::Uuid;
+
+pub use super::_entities::users::{self, ActiveModel, Entity, Model};
+
+pub const MAGIC_LINK_LENGTH: i8 = 32;
+pub const MAGIC_LINK_EXPIRATION_MIN: i8 = 5;
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct LoginParams {
+    pub email: String,
+    pub password: String,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct RegisterParams {
+    pub email: String,
+    pub password: String,
+    pub name: String,
+}
+
+#[derive(Debug, Validate, Deserialize)]
+pub struct Validator {
+    #[validate(length(min = 2, message = "Name must be at least 2 characters long."))]
+    pub name: String,
+    #[validate(email(message = "invalid email"))]
+    pub email: String,
+}
+
+impl Validatable for ActiveModel {
+    fn validator(&self) -> Box<dyn Validate> {
+        Box::new(Validator {
+            name: self.name.as_ref().to_owned(),
+            email: self.email.as_ref().to_owned(),
+        })
+    }
+}
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for super::_entities::users::ActiveModel {
+    async fn before_save<C>(self, _db: &C, insert: bool) -> Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        self.validate()?;
+        if insert {
+            let mut this = self;
+            this.pid = ActiveValue::Set(Uuid::new_v4());
+            this.api_key = ActiveValue::Set(format!("lo-{}", Uuid::new_v4()));
+            Ok(this)
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+#[async_trait]
+impl Authenticable for Model {
+    async fn find_by_api_key(db: &DatabaseConnection, api_key: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::ApiKey, api_key)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    async fn find_by_claims_key(db: &DatabaseConnection, claims_key: &str) -> ModelResult<Self> {
+        Self::find_by_pid(db, claims_key).await
+    }
+}
+
+impl Model {
+    /// finds a user by the provided email
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_email(db: &DatabaseConnection, email: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::Email, email)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// finds a user by the provided verification token
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_verification_token(
+        db: &DatabaseConnection,
+        token: &str,
+    ) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::EmailVerificationToken, token)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// finds a user by the magic token and verify and token expiration
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error ot token expired
+    pub async fn find_by_magic_token(db: &DatabaseConnection, token: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                query::condition()
+                    .eq(users::Column::MagicLinkToken, token)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+
+        let user = user.ok_or_else(|| ModelError::EntityNotFound)?;
+        if let Some(expired_at) = user.magic_link_expiration {
+            if expired_at >= Local::now() {
+                Ok(user)
+            } else {
+                tracing::debug!(
+                    user_pid = user.pid.to_string(),
+                    token_expiration = expired_at.to_string(),
+                    "magic token expired for the user."
+                );
+                Err(ModelError::msg("magic token expired"))
+            }
+        } else {
+            tracing::error!(
+                user_pid = user.pid.to_string(),
+                "magic link expiration time not exists"
+            );
+            Err(ModelError::msg("expiration token not exists"))
+        }
+    }
+
+    /// finds a user by the provided reset token
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_reset_token(db: &DatabaseConnection, token: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::ResetToken, token)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// finds a user by the provided pid
+    ///
+    /// # Errors
+    ///
+    /// When could not find user  or DB query error
+    pub async fn find_by_pid(db: &DatabaseConnection, pid: &str) -> ModelResult<Self> {
+        let parse_uuid = Uuid::parse_str(pid).map_err(|e| ModelError::Any(e.into()))?;
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::Pid, parse_uuid)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// finds a user by the provided api key
+    ///
+    /// # Errors
+    ///
+    /// When could not find user by the given token or DB query error
+    pub async fn find_by_api_key(db: &DatabaseConnection, api_key: &str) -> ModelResult<Self> {
+        let user = users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::ApiKey, api_key)
+                    .build(),
+            )
+            .one(db)
+            .await?;
+        user.ok_or_else(|| ModelError::EntityNotFound)
+    }
+
+    /// Verifies whether the provided plain password matches the hashed password
+    ///
+    /// # Errors
+    ///
+    /// when could not verify password
+    #[must_use]
+    pub fn verify_password(&self, password: &str) -> bool {
+        hash::verify_password(password, &self.password)
+    }
+
+    /// Asynchronously creates a user with a password and saves it to the
+    /// database.
+    ///
+    /// # Errors
+    ///
+    /// When could not save the user into the DB
+    pub async fn create_with_password(
+        db: &DatabaseConnection,
+        params: &RegisterParams,
+    ) -> ModelResult<Self> {
+        let txn = db.begin().await?;
+
+        if users::Entity::find()
+            .filter(
+                model::query::condition()
+                    .eq(users::Column::Email, &params.email)
+                    .build(),
+            )
+            .one(&txn)
+            .await?
+            .is_some()
+        {
+            return Err(ModelError::EntityAlreadyExists {});
+        }
+
+        let password_hash =
+            hash::hash_password(&params.password).map_err(|e| ModelError::Any(e.into()))?;
+        let user = users::ActiveModel {
+            email: ActiveValue::set(params.email.to_string()),
+            password: ActiveValue::set(password_hash),
+            name: ActiveValue::set(params.name.to_string()),
+            ..Default::default()
+        }
+        .insert(&txn)
+        .await?;
+
+        txn.commit().await?;
+
+        Ok(user)
+    }
+
+    /// Creates a JWT
+    ///
+    /// # Errors
+    ///
+    /// when could not convert user claims to jwt token
+    pub fn generate_jwt(&self, secret: &str, expiration: u64) -> ModelResult<String> {
+        jwt::JWT::new(secret)
+            .generate_token(expiration, self.pid.to_string(), Map::new())
+            .map_err(ModelError::from)
+    }
+}
+
+impl ActiveModel {
+    /// Sets the email verification information for the user and
+    /// updates it in the database.
+    ///
+    /// This method is used to record the timestamp when the email verification
+    /// was sent and generate a unique verification token for the user.
+    ///
+    /// # Errors
+    ///
+    /// when has DB query error
+    pub async fn set_email_verification_sent(
+        mut self,
+        db: &DatabaseConnection,
+    ) -> ModelResult<Model> {
+        self.email_verification_sent_at = ActiveValue::set(Some(Local::now().into()));
+        self.email_verification_token = ActiveValue::Set(Some(Uuid::new_v4().to_string()));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Sets the information for a reset password request,
+    /// generates a unique reset password token, and updates it in the
+    /// database.
+    ///
+    /// This method records the timestamp when the reset password token is sent
+    /// and generates a unique token for the user.
+    ///
+    /// # Arguments
+    ///
+    /// # Errors
+    ///
+    /// when has DB query error
+    pub async fn set_forgot_password_sent(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        self.reset_sent_at = ActiveValue::set(Some(Local::now().into()));
+        self.reset_token = ActiveValue::Set(Some(Uuid::new_v4().to_string()));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Records the verification time when a user verifies their
+    /// email and updates it in the database.
+    ///
+    /// This method sets the timestamp when the user successfully verifies their
+    /// email.
+    ///
+    /// # Errors
+    ///
+    /// when has DB query error
+    pub async fn verified(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        self.email_verified_at = ActiveValue::set(Some(Local::now().into()));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Resets the current user password with a new password and
+    /// updates it in the database.
+    ///
+    /// This method hashes the provided password and sets it as the new password
+    /// for the user.
+    ///
+    /// # Errors
+    ///
+    /// when has DB query error or could not hashed the given password
+    pub async fn reset_password(
+        mut self,
+        db: &DatabaseConnection,
+        password: &str,
+    ) -> ModelResult<Model> {
+        self.password =
+            ActiveValue::set(hash::hash_password(password).map_err(|e| ModelError::Any(e.into()))?);
+        self.reset_token = ActiveValue::Set(None);
+        self.reset_sent_at = ActiveValue::Set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Creates a magic link token for passwordless authentication.
+    ///
+    /// Generates a random token with a specified length and sets an expiration time
+    /// for the magic link. This method is used to initiate the magic link authentication flow.
+    ///
+    /// # Errors
+    /// - Returns an error if database update fails
+    pub async fn create_magic_link(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        let random_str = hash::random_string(MAGIC_LINK_LENGTH as usize);
+        let expired = Local::now() + Duration::minutes(MAGIC_LINK_EXPIRATION_MIN.into());
+
+        self.magic_link_token = ActiveValue::set(Some(random_str));
+        self.magic_link_expiration = ActiveValue::set(Some(expired.into()));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Verifies and invalidates the magic link after successful authentication.
+    ///
+    /// Clears the magic link token and expiration time after the user has
+    /// successfully authenticated using the magic link.
+    ///
+    /// # Errors
+    /// - Returns an error if database update fails
+    pub async fn clear_magic_link(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        self.magic_link_token = ActiveValue::set(None);
+        self.magic_link_expiration = ActiveValue::set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+}
--- a/src/tasks/mod.rs
+++ b/src/tasks/mod.rs
@@ -0,0 +1 @@
+
--- a/src/views/auth.rs
+++ b/src/views/auth.rs
@@ -0,0 +1,41 @@
+use serde::{Deserialize, Serialize};
+
+use crate::models::_entities::users;
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct LoginResponse {
+    pub token: String,
+    pub pid: String,
+    pub name: String,
+    pub is_verified: bool,
+}
+
+impl LoginResponse {
+    #[must_use]
+    pub fn new(user: &users::Model, token: &String) -> Self {
+        Self {
+            token: token.to_string(),
+            pid: user.pid.to_string(),
+            name: user.name.clone(),
+            is_verified: user.email_verified_at.is_some(),
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct CurrentResponse {
+    pub pid: String,
+    pub name: String,
+    pub email: String,
+}
+
+impl CurrentResponse {
+    #[must_use]
+    pub fn new(user: &users::Model) -> Self {
+        Self {
+            pid: user.pid.to_string(),
+            name: user.name.clone(),
+            email: user.email.clone(),
+        }
+    }
+}
--- a/src/views/mod.rs
+++ b/src/views/mod.rs
@@ -0,0 +1 @@
+pub mod auth;
--- a/src/workers/downloader.rs
+++ b/src/workers/downloader.rs
@@ -0,0 +1,23 @@
+use loco_rs::prelude::*;
+use serde::{Deserialize, Serialize};
+
+pub struct DownloadWorker {
+    pub ctx: AppContext,
+}
+
+#[derive(Deserialize, Debug, Serialize)]
+pub struct DownloadWorkerArgs {
+    pub user_guid: String,
+}
+
+#[async_trait]
+impl BackgroundWorker<DownloadWorkerArgs> for DownloadWorker {
+    fn build(ctx: &AppContext) -> Self {
+        Self { ctx: ctx.clone() }
+    }
+    async fn perform(&self, _args: DownloadWorkerArgs) -> Result<()> {
+        // TODO: Some actual work goes here...
+
+        Ok(())
+    }
+}
--- a/src/workers/mod.rs
+++ b/src/workers/mod.rs
@@ -0,0 +1 @@
+pub mod downloader;
--- a/tests/mod.rs
+++ b/tests/mod.rs
@@ -0,0 +1,4 @@
+mod models;
+mod requests;
+mod tasks;
+mod workers;
--- a/tests/models/mod.rs
+++ b/tests/models/mod.rs
@@ -0,0 +1 @@
+mod users;
--- a/tests/models/snapshots/can_create_with_password@users.snap
+++ b/tests/models/snapshots/can_create_with_password@users.snap
@@ -0,0 +1,23 @@
+---
+source: tests/models/users.rs
+expression: res
+---
+Ok(
+    Model {
+        created_at: DATE,
+        updated_at: DATE,
+        id: ID
+        pid: PID,
+        email: "test@framework.com",
+        password: "PASSWORD",
+        api_key: "lo-PID",
+        name: "framework",
+        reset_token: None,
+        reset_sent_at: None,
+        email_verification_token: None,
+        email_verification_sent_at: None,
+        email_verified_at: None,
+        magic_link_token: None,
+        magic_link_expiration: None,
+    },
+)
--- a/tests/models/snapshots/can_find_by_email@users-2.snap
+++ b/tests/models/snapshots/can_find_by_email@users-2.snap
@@ -0,0 +1,7 @@
+---
+source: tests/models/users.rs
+expression: non_existing_user_results
+---
+Err(
+    EntityNotFound,
+)
--- a/tests/models/snapshots/can_find_by_email@users.snap
+++ b/tests/models/snapshots/can_find_by_email@users.snap
@@ -0,0 +1,23 @@
+---
+source: tests/models/users.rs
+expression: existing_user
+---
+Ok(
+    Model {
+        created_at: 2023-11-12T12:34:56.789+00:00,
+        updated_at: 2023-11-12T12:34:56.789+00:00,
+        id: 1,
+        pid: 11111111-1111-1111-1111-111111111111,
+        email: "user1@example.com",
+        password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
+        name: "user1",
+        reset_token: None,
+        reset_sent_at: None,
+        email_verification_token: None,
+        email_verification_sent_at: None,
+        email_verified_at: None,
+        magic_link_token: None,
+        magic_link_expiration: None,
+    },
+)
--- a/tests/models/snapshots/can_find_by_pid@users-2.snap
+++ b/tests/models/snapshots/can_find_by_pid@users-2.snap
@@ -0,0 +1,7 @@
+---
+source: tests/models/users.rs
+expression: non_existing_user_results
+---
+Err(
+    EntityNotFound,
+)
--- a/tests/models/snapshots/can_find_by_pid@users.snap
+++ b/tests/models/snapshots/can_find_by_pid@users.snap
@@ -0,0 +1,23 @@
+---
+source: tests/models/users.rs
+expression: existing_user
+---
+Ok(
+    Model {
+        created_at: 2023-11-12T12:34:56.789+00:00,
+        updated_at: 2023-11-12T12:34:56.789+00:00,
+        id: 1,
+        pid: 11111111-1111-1111-1111-111111111111,
+        email: "user1@example.com",
+        password: "$argon2id$v=19$m=19456,t=2,p=1$ETQBx4rTgNAZhSaeYZKOZg$eYTdH26CRT6nUJtacLDEboP0li6xUwUF/q5nSlQ8uuc",
+        api_key: "lo-95ec80d7-cb60-4b70-9b4b-9ef74cb88758",
+        name: "user1",
+        reset_token: None,
+        reset_sent_at: None,
+        email_verification_token: None,
+        email_verification_sent_at: None,
+        email_verified_at: None,
+        magic_link_token: None,
+        magic_link_expiration: None,
+    },
+)
--- a/tests/models/snapshots/can_validate_model@users.snap
+++ b/tests/models/snapshots/can_validate_model@users.snap
@@ -0,0 +1,9 @@
+---
+source: tests/models/users.rs
+expression: res
+---
+Err(
+    Custom(
+        "{\"email\":[{\"code\":\"email\",\"message\":\"invalid email\"}],\"name\":[{\"code\":\"length\",\"message\":\"Name must be at least 2 characters long.\"}]}",
+    ),
+)
--- a/tests/models/snapshots/handle_create_with_password_with_duplicate@users.snap
+++ b/tests/models/snapshots/handle_create_with_password_with_duplicate@users.snap
@@ -0,0 +1,7 @@
+---
+source: tests/models/users.rs
+expression: new_user
+---
+Err(
+    EntityAlreadyExists,
+)
--- a/tests/models/users.rs
+++ b/tests/models/users.rs
@@ -0,0 +1,360 @@
+use chrono::{offset::Local, Duration};
+use insta::assert_debug_snapshot;
+use loco_rs::testing::prelude::*;
+use sea_orm::{ActiveModelTrait, ActiveValue, IntoActiveModel};
+use serial_test::serial;
+use universal_web::{
+    app::App,
+    models::users::{self, Model, RegisterParams},
+};
+
+macro_rules! configure_insta {
+    ($($expr:expr),*) => {
+        let mut settings = insta::Settings::clone_current();
+        settings.set_prepend_module_to_snapshot(false);
+        settings.set_snapshot_suffix("users");
+        let _guard = settings.bind_to_scope();
+    };
+}
+
+#[tokio::test]
+#[serial]
+async fn test_can_validate_model() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+
+    let invalid_user = users::ActiveModel {
+        name: ActiveValue::set("1".to_string()),
+        email: ActiveValue::set("invalid-email".to_string()),
+        ..Default::default()
+    };
+
+    let res = invalid_user.insert(&boot.app_context.db).await;
+
+    assert_debug_snapshot!(res);
+}
+
+#[tokio::test]
+#[serial]
+async fn can_create_with_password() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+
+    let params = RegisterParams {
+        email: "test@framework.com".to_string(),
+        password: "1234".to_string(),
+        name: "framework".to_string(),
+    };
+
+    let res = Model::create_with_password(&boot.app_context.db, &params).await;
+
+    insta::with_settings!({
+        filters => cleanup_user_model()
+    }, {
+        assert_debug_snapshot!(res);
+    });
+}
+#[tokio::test]
+#[serial]
+async fn handle_create_with_password_with_duplicate() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let new_user = Model::create_with_password(
+        &boot.app_context.db,
+        &RegisterParams {
+            email: "user1@example.com".to_string(),
+            password: "1234".to_string(),
+            name: "framework".to_string(),
+        },
+    )
+    .await;
+
+    assert_debug_snapshot!(new_user);
+}
+
+#[tokio::test]
+#[serial]
+async fn can_find_by_email() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let existing_user = Model::find_by_email(&boot.app_context.db, "user1@example.com").await;
+    let non_existing_user_results =
+        Model::find_by_email(&boot.app_context.db, "un@existing-email.com").await;
+
+    assert_debug_snapshot!(existing_user);
+    assert_debug_snapshot!(non_existing_user_results);
+}
+
+#[tokio::test]
+#[serial]
+async fn can_find_by_pid() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let existing_user =
+        Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111").await;
+    let non_existing_user_results =
+        Model::find_by_pid(&boot.app_context.db, "23232323-2323-2323-2323-232323232323").await;
+
+    assert_debug_snapshot!(existing_user);
+    assert_debug_snapshot!(non_existing_user_results);
+}
+
+#[tokio::test]
+#[serial]
+async fn can_verification_token() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID");
+
+    assert!(
+        user.email_verification_sent_at.is_none(),
+        "Expected no email verification sent timestamp"
+    );
+    assert!(
+        user.email_verification_token.is_none(),
+        "Expected no email verification token"
+    );
+
+    let result = user
+        .into_active_model()
+        .set_email_verification_sent(&boot.app_context.db)
+        .await;
+
+    assert!(result.is_ok(), "Failed to set email verification sent");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID after setting verification sent");
+
+    assert!(
+        user.email_verification_sent_at.is_some(),
+        "Expected email verification sent timestamp to be present"
+    );
+    assert!(
+        user.email_verification_token.is_some(),
+        "Expected email verification token to be present"
+    );
+}
+
+#[tokio::test]
+#[serial]
+async fn can_set_forgot_password_sent() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID");
+
+    assert!(
+        user.reset_sent_at.is_none(),
+        "Expected no reset sent timestamp"
+    );
+    assert!(user.reset_token.is_none(), "Expected no reset token");
+
+    let result = user
+        .into_active_model()
+        .set_forgot_password_sent(&boot.app_context.db)
+        .await;
+
+    assert!(result.is_ok(), "Failed to set forgot password sent");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID after setting forgot password sent");
+
+    assert!(
+        user.reset_sent_at.is_some(),
+        "Expected reset sent timestamp to be present"
+    );
+    assert!(
+        user.reset_token.is_some(),
+        "Expected reset token to be present"
+    );
+}
+
+#[tokio::test]
+#[serial]
+async fn can_verified() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID");
+
+    assert!(
+        user.email_verified_at.is_none(),
+        "Expected email to be unverified"
+    );
+
+    let result = user
+        .into_active_model()
+        .verified(&boot.app_context.db)
+        .await;
+
+    assert!(result.is_ok(), "Failed to mark email as verified");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID after verification");
+
+    assert!(
+        user.email_verified_at.is_some(),
+        "Expected email to be verified"
+    );
+}
+
+#[tokio::test]
+#[serial]
+async fn can_reset_password() {
+    configure_insta!();
+
+    let boot = boot_test::<App>()
+        .await
+        .expect("Failed to boot test application");
+    seed::<App>(&boot.app_context)
+        .await
+        .expect("Failed to seed database");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID");
+
+    assert!(
+        user.verify_password("12341234"),
+        "Password verification failed for original password"
+    );
+
+    let result = user
+        .clone()
+        .into_active_model()
+        .reset_password(&boot.app_context.db, "new-password")
+        .await;
+
+    assert!(result.is_ok(), "Failed to reset password");
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .expect("Failed to find user by PID after password reset");
+
+    assert!(
+        user.verify_password("new-password"),
+        "Password verification failed for new password"
+    );
+}
+
+#[tokio::test]
+#[serial]
+async fn magic_link() {
+    let boot = boot_test::<App>().await.unwrap();
+    seed::<App>(&boot.app_context).await.unwrap();
+
+    let user = Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+        .await
+        .unwrap();
+
+    assert!(
+        user.magic_link_token.is_none(),
+        "Magic link token should be initially unset"
+    );
+    assert!(
+        user.magic_link_expiration.is_none(),
+        "Magic link expiration should be initially unset"
+    );
+
+    let create_result = user
+        .into_active_model()
+        .create_magic_link(&boot.app_context.db)
+        .await;
+
+    assert!(
+        create_result.is_ok(),
+        "Failed to create magic link: {:?}",
+        create_result.unwrap_err()
+    );
+
+    let updated_user =
+        Model::find_by_pid(&boot.app_context.db, "11111111-1111-1111-1111-111111111111")
+            .await
+            .expect("Failed to refetch user after magic link creation");
+
+    assert!(
+        updated_user.magic_link_token.is_some(),
+        "Magic link token should be set after creation"
+    );
+
+    let magic_link_token = updated_user.magic_link_token.unwrap();
+    assert_eq!(
+        magic_link_token.len(),
+        users::MAGIC_LINK_LENGTH as usize,
+        "Magic link token length does not match expected length"
+    );
+
+    assert!(
+        updated_user.magic_link_expiration.is_some(),
+        "Magic link expiration should be set after creation"
+    );
+
+    let now = Local::now();
+    let should_expired_at = now + Duration::minutes(users::MAGIC_LINK_EXPIRATION_MIN.into());
+    let actual_expiration = updated_user.magic_link_expiration.unwrap();
+
+    assert!(
+        actual_expiration >= now,
+        "Magic link expiration should be in the future or now"
+    );
+
+    assert!(
+        actual_expiration <= should_expired_at,
+        "Magic link expiration exceeds expected maximum expiration time"
+    );
+}
--- a/tests/requests/auth.rs
+++ b/tests/requests/auth.rs
@@ -0,0 +1,502 @@
+use insta::{assert_debug_snapshot, with_settings};
+use loco_rs::testing::prelude::*;
+use rstest::rstest;
+use serial_test::serial;
+use universal_web::{app::App, models::users};
+
+use super::prepare_data;
+
+// TODO: see how to dedup / extract this to app-local test utils
+// not to framework, because that would require a runtime dep on insta
+macro_rules! configure_insta {
+    ($($expr:expr),*) => {
+        let mut settings = insta::Settings::clone_current();
+        settings.set_prepend_module_to_snapshot(false);
+        settings.set_snapshot_suffix("auth_request");
+        let _guard = settings.bind_to_scope();
+    };
+}
+
+#[tokio::test]
+#[serial]
+async fn can_register() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let email = "test@loco.com";
+        let payload = serde_json::json!({
+            "name": "loco",
+            "email": email,
+            "password": "12341234"
+        });
+
+        let response = request.post("/api/auth/register").json(&payload).await;
+        assert_eq!(
+            response.status_code(),
+            200,
+            "Register request should succeed"
+        );
+        let saved_user = users::Model::find_by_email(&ctx.db, email).await;
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!(saved_user);
+        });
+
+        let deliveries = ctx.mailer.unwrap().deliveries();
+        assert_eq!(deliveries.count, 1, "Exactly one email should be sent");
+
+        // with_settings!({
+        //     filters => cleanup_email()
+        // }, {
+        //     assert_debug_snapshot!(ctx.mailer.unwrap().deliveries());
+        // });
+    })
+    .await;
+}
+
+#[rstest]
+#[case("login_with_valid_password", "12341234")]
+#[case("login_with_invalid_password", "invalid-password")]
+#[tokio::test]
+#[serial]
+async fn can_login_with_verify(#[case] test_name: &str, #[case] password: &str) {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let email = "test@loco.com";
+        let register_payload = serde_json::json!({
+            "name": "loco",
+            "email": email,
+            "password": "12341234"
+        });
+
+        //Creating a new user
+        let register_response = request
+            .post("/api/auth/register")
+            .json(&register_payload)
+            .await;
+
+        assert_eq!(
+            register_response.status_code(),
+            200,
+            "Register request should succeed"
+        );
+
+        let user = users::Model::find_by_email(&ctx.db, email).await.unwrap();
+        let email_verification_token = user
+            .email_verification_token
+            .expect("Email verification token should be generated");
+        request
+            .get(&format!("/api/auth/verify/{email_verification_token}"))
+            .await;
+
+        //verify user request
+        let response = request
+            .post("/api/auth/login")
+            .json(&serde_json::json!({
+                "email": email,
+                "password": password
+            }))
+            .await;
+
+        // Make sure email_verified_at is set
+        let user = users::Model::find_by_email(&ctx.db, email)
+            .await
+            .expect("Failed to find user by email");
+
+        assert!(
+            user.email_verified_at.is_some(),
+            "Expected the email to be verified, but it was not. User: {:?}",
+            user
+        );
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!(test_name, (response.status_code(), response.text()));
+        });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn login_with_un_existing_email() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, _ctx| async move {
+      
+        let login_response = request
+            .post("/api/auth/login")
+            .json(&serde_json::json!({
+                "email": "un_existing@loco.rs",
+                "password":  "1234"
+            }))
+            .await;
+
+        assert_eq!(login_response.status_code(), 401, "Login request should return 401");
+        login_response.assert_json(&serde_json::json!({"error": "unauthorized", "description": "You do not have permission to access this resource"}));
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_login_without_verify() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, _ctx| async move {
+        let email = "test@loco.com";
+        let password = "12341234";
+        let register_payload = serde_json::json!({
+            "name": "loco",
+            "email": email,
+            "password": password
+        });
+
+        //Creating a new user
+        let register_response = request
+            .post("/api/auth/register")
+            .json(&register_payload)
+            .await;
+
+        assert_eq!(
+            register_response.status_code(),
+            200,
+            "Register request should succeed"
+        );
+
+        //verify user request
+        let login_response = request
+            .post("/api/auth/login")
+            .json(&serde_json::json!({
+                "email": email,
+                "password": password
+            }))
+            .await;
+
+        assert_eq!(
+            login_response.status_code(),
+            200,
+            "Login request should succeed"
+        );
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!(login_response.text());
+        });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn invalid_verification_token() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, _ctx| async move {
+        let response = request.get("/api/auth/verify/invalid-token").await;
+
+        assert_eq!(response.status_code(), 401, "Verify request should reject");
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_reset_password() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let login_data = prepare_data::init_user_login(&request, &ctx).await;
+
+        let forgot_payload = serde_json::json!({
+            "email": login_data.user.email,
+        });
+        let forget_response = request.post("/api/auth/forgot").json(&forgot_payload).await;
+        assert_eq!(
+            forget_response.status_code(),
+            200,
+            "Forget request should succeed"
+        );
+
+        let user = users::Model::find_by_email(&ctx.db, &login_data.user.email)
+            .await
+            .expect("Failed to find user by email");
+
+        assert!(
+            user.reset_token.is_some(),
+            "Expected reset_token to be set, but it was None. User: {user:?}"
+        );
+        assert!(
+            user.reset_sent_at.is_some(),
+            "Expected reset_sent_at to be set, but it was None. User: {user:?}"
+        );
+
+        let new_password = "new-password";
+        let reset_payload = serde_json::json!({
+            "token": user.reset_token,
+            "password": new_password,
+        });
+
+        let reset_response = request.post("/api/auth/reset").json(&reset_payload).await;
+        assert_eq!(
+            reset_response.status_code(),
+            200,
+            "Reset password request should succeed"
+        );
+
+        let user = users::Model::find_by_email(&ctx.db, &user.email)
+            .await
+            .unwrap();
+
+        assert!(user.reset_token.is_none());
+        assert!(user.reset_sent_at.is_none());
+
+        assert_debug_snapshot!(reset_response.text());
+
+        let login_response = request
+            .post("/api/auth/login")
+            .json(&serde_json::json!({
+                "email": user.email,
+                "password": new_password
+            }))
+            .await;
+
+        assert_eq!(
+            login_response.status_code(),
+            200,
+            "Login request should succeed"
+        );
+
+        let deliveries = ctx.mailer.unwrap().deliveries();
+        assert_eq!(deliveries.count, 2, "Exactly one email should be sent");
+        // with_settings!({
+        //     filters => cleanup_email()
+        // }, {
+        //     assert_debug_snapshot!(deliveries.messages);
+        // });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_get_current_user() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let user = prepare_data::init_user_login(&request, &ctx).await;
+
+        let (auth_key, auth_value) = prepare_data::auth_header(&user.token);
+        let response = request
+            .get("/api/auth/current")
+            .add_header(auth_key, auth_value)
+            .await;
+
+        assert_eq!(
+            response.status_code(),
+            200,
+            "Current request should succeed"
+        );
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!((response.status_code(), response.text()));
+        });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_auth_with_magic_link() {
+    configure_insta!();
+    request::<App, _, _>(|request, ctx| async move {
+        seed::<App>(&ctx).await.unwrap();
+
+        let payload = serde_json::json!({
+            "email": "user1@example.com",
+        });
+        let response = request.post("/api/auth/magic-link").json(&payload).await;
+        assert_eq!(
+            response.status_code(),
+            200,
+            "Magic link request should succeed"
+        );
+
+        let deliveries = ctx.mailer.unwrap().deliveries();
+        assert_eq!(deliveries.count, 1, "Exactly one email should be sent");
+
+        // let redact_token = format!("[a-zA-Z0-9]{{{}}}", users::MAGIC_LINK_LENGTH);
+        // with_settings!({
+        //      filters => {
+        //          let mut combined_filters = cleanup_email().clone();
+        //         combined_filters.extend(vec![(r"(\\r\\n|=\\r\\n)", ""), (redact_token.as_str(), "[REDACT_TOKEN]") ]);
+        //         combined_filters
+        //     }
+        // }, {
+        //     assert_debug_snapshot!(deliveries.messages);
+        // });
+
+        let user = users::Model::find_by_email(&ctx.db, "user1@example.com")
+            .await
+            .expect("User should be found");
+
+        let magic_link_token = user
+            .magic_link_token
+            .expect("Magic link token should be generated");
+        let magic_link_response = request
+            .get(&format!("/api/auth/magic-link/{magic_link_token}"))
+            .await;
+        assert_eq!(
+            magic_link_response.status_code(),
+            200,
+            "Magic link authentication should succeed"
+        );
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!(magic_link_response.text());
+        });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_reject_invalid_email() {
+    configure_insta!();
+    request::<App, _, _>(|request, _ctx| async move {
+        let invalid_email = "user1@temp-mail.com";
+        let payload = serde_json::json!({
+            "email": invalid_email,
+        });
+        let response = request.post("/api/auth/magic-link").json(&payload).await;
+        assert_eq!(
+            response.status_code(),
+            400,
+            "Expected request with invalid email '{invalid_email}' to be blocked, but it was allowed."
+        );
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_reject_invalid_magic_link_token() {
+    configure_insta!();
+    request::<App, _, _>(|request, ctx| async move {
+        seed::<App>(&ctx).await.unwrap();
+
+        let magic_link_response = request.get("/api/auth/magic-link/invalid-token").await;
+        assert_eq!(
+            magic_link_response.status_code(),
+            401,
+            "Magic link authentication should be rejected"
+        );
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn can_resend_verification_email() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let email = "test@loco.com";
+        let payload = serde_json::json!({
+            "name": "loco",
+            "email": email,
+            "password": "12341234"
+        });
+
+        let response = request.post("/api/auth/register").json(&payload).await;
+        assert_eq!(
+            response.status_code(),
+            200,
+            "Register request should succeed"
+        );
+
+        let resend_payload = serde_json::json!({ "email": email });
+
+        let resend_response = request
+            .post("/api/auth/resend-verification-mail")
+            .json(&resend_payload)
+            .await;
+
+        assert_eq!(
+            resend_response.status_code(),
+            200,
+            "Resend verification email should succeed"
+        );
+
+        let deliveries = ctx.mailer.unwrap().deliveries();
+
+        assert_eq!(
+            deliveries.count, 2,
+            "Two emails should have been sent: welcome and re-verification"
+        );
+
+        let user = users::Model::find_by_email(&ctx.db, email)
+            .await
+            .expect("User should exist");
+
+        with_settings!({
+            filters => cleanup_user_model()
+        }, {
+            assert_debug_snapshot!("resend_verification_user", user);
+        });
+    })
+    .await;
+}
+
+#[tokio::test]
+#[serial]
+async fn cannot_resend_email_if_already_verified() {
+    configure_insta!();
+
+    request::<App, _, _>(|request, ctx| async move {
+        let email = "verified@loco.com";
+        let payload = serde_json::json!({
+            "name": "verified",
+            "email": email,
+            "password": "12341234"
+        });
+
+        request.post("/api/auth/register").json(&payload).await;
+
+        // Verify user
+        let user = users::Model::find_by_email(&ctx.db, email).await.unwrap();
+        if let Some(token) = user.email_verification_token.clone() {
+            request.get(&format!("/api/auth/verify/{token}")).await;
+        }
+
+        // Try resending verification email
+        let resend_payload = serde_json::json!({ "email": email });
+
+        let resend_response = request
+            .post("/api/auth/resend-verification-mail")
+            .json(&resend_payload)
+            .await;
+
+        assert_eq!(
+            resend_response.status_code(),
+            200,
+            "Should return 200 even if already verified"
+        );
+
+        let deliveries = ctx.mailer.unwrap().deliveries();
+        assert_eq!(
+            deliveries.count, 1,
+            "Only the original welcome email should be sent"
+        );
+    })
+    .await;
+}
--- a/tests/requests/mod.rs
+++ b/tests/requests/mod.rs
@@ -0,0 +1,2 @@
+mod auth;
+mod prepare_data;
--- a/tests/requests/prepare_data.rs
+++ b/tests/requests/prepare_data.rs
@@ -0,0 +1,57 @@
+use axum::http::{HeaderName, HeaderValue};
+use loco_rs::{app::AppContext, TestServer};
+use universal_web::{models::users, views::auth::LoginResponse};
+
+const USER_EMAIL: &str = "test@loco.com";
+const USER_PASSWORD: &str = "1234";
+
+pub struct LoggedInUser {
+    pub user: users::Model,
+    pub token: String,
+}
+
+pub async fn init_user_login(request: &TestServer, ctx: &AppContext) -> LoggedInUser {
+    let register_payload = serde_json::json!({
+        "name": "loco",
+        "email": USER_EMAIL,
+        "password": USER_PASSWORD
+    });
+
+    //Creating a new user
+    request
+        .post("/api/auth/register")
+        .json(&register_payload)
+        .await;
+    let user = users::Model::find_by_email(&ctx.db, USER_EMAIL)
+        .await
+        .unwrap();
+
+    let verify_payload = serde_json::json!({
+        "token": user.email_verification_token,
+    });
+
+    request.post("/api/auth/verify").json(&verify_payload).await;
+
+    let response = request
+        .post("/api/auth/login")
+        .json(&serde_json::json!({
+            "email": USER_EMAIL,
+            "password": USER_PASSWORD
+        }))
+        .await;
+
+    let login_response: LoginResponse = serde_json::from_str(&response.text()).unwrap();
+
+    LoggedInUser {
+        user: users::Model::find_by_email(&ctx.db, USER_EMAIL)
+            .await
+            .unwrap(),
+        token: login_response.token,
+    }
+}
+
+pub fn auth_header(token: &str) -> (HeaderName, HeaderValue) {
+    let auth_header_value = HeaderValue::from_str(&format!("Bearer {}", &token)).unwrap();
+
+    (HeaderName::from_static("authorization"), auth_header_value)
+}
--- a/tests/requests/snapshots/can_auth_with_magic_link@auth_request.snap
+++ b/tests/requests/snapshots/can_auth_with_magic_link@auth_request.snap
@@ -0,0 +1,5 @@
+---
+source: tests/requests/auth.rs
+expression: magic_link_response.text()
+---
+"{\"token\":\"TOKEN\",\"pid\":\"PID\",\"name\":\"user1\",\"is_verified\":false}"
--- a/tests/requests/snapshots/can_get_current_user@auth_request.snap
+++ b/tests/requests/snapshots/can_get_current_user@auth_request.snap
@@ -0,0 +1,8 @@
+---
+source: tests/requests/auth.rs
+expression: "(response.status_code(), response.text())"
+---
+(
+    200,
+    "{\"pid\":\"PID\",\"name\":\"loco\",\"email\":\"test@loco.com\"}",
+)
--- a/tests/requests/snapshots/can_login_without_verify@auth_request.snap
+++ b/tests/requests/snapshots/can_login_without_verify@auth_request.snap
@@ -0,0 +1,5 @@
+---
+source: tests/requests/auth.rs
+expression: login_response.text()
+---
+"{\"token\":\"TOKEN\",\"pid\":\"PID\",\"name\":\"loco\",\"is_verified\":false}"
--- a/tests/requests/snapshots/can_register@auth_request.snap
+++ b/tests/requests/snapshots/can_register@auth_request.snap
@@ -0,0 +1,27 @@
+---
+source: tests/requests/auth.rs
+expression: saved_user
+---
+Ok(
+    Model {
+        created_at: DATE,
+        updated_at: DATE,
+        id: ID
+        pid: PID,
+        email: "test@loco.com",
+        password: "PASSWORD",
+        api_key: "lo-PID",
+        name: "loco",
+        reset_token: None,
+        reset_sent_at: None,
+        email_verification_token: Some(
+            "PID",
+        ),
+        email_verification_sent_at: Some(
+            DATE,
+        ),
+        email_verified_at: None,
+        magic_link_token: None,
+        magic_link_expiration: None,
+    },
+)
--- a/tests/requests/snapshots/can_reset_password@auth_request.snap
+++ b/tests/requests/snapshots/can_reset_password@auth_request.snap
@@ -0,0 +1,5 @@
+---
+source: tests/requests/auth.rs
+expression: "(reset_response.status_code(), reset_response.text())"
+---
+"null"
--- a/tests/requests/snapshots/login_with_invalid_password@auth_request.snap
+++ b/tests/requests/snapshots/login_with_invalid_password@auth_request.snap
@@ -0,0 +1,8 @@
+---
+source: tests/requests/auth.rs
+expression: "(response.status_code(), response.text())"
+---
+(
+    401,
+    "{\"error\":\"unauthorized\",\"description\":\"You do not have permission to access this resource\"}",
+)
--- a/tests/requests/snapshots/login_with_valid_password@auth_request.snap
+++ b/tests/requests/snapshots/login_with_valid_password@auth_request.snap
@@ -0,0 +1,8 @@
+---
+source: tests/requests/auth.rs
+expression: "(response.status_code(), response.text())"
+---
+(
+    200,
+    "{\"token\":\"TOKEN\",\"pid\":\"PID\",\"name\":\"loco\",\"is_verified\":true}",
+)
--- a/tests/requests/snapshots/resend_verification_user@auth_request.snap
+++ b/tests/requests/snapshots/resend_verification_user@auth_request.snap
@@ -0,0 +1,26 @@
+---
+source: tests/requests/auth.rs
+assertion_line: 414
+expression: user
+---
+Model {
+    created_at: DATE,
+    updated_at: DATE,
+    id: ID
+    pid: PID,
+    email: "test@loco.com",
+    password: "PASSWORD",
+    api_key: "lo-PID",
+    name: "loco",
+    reset_token: None,
+    reset_sent_at: None,
+    email_verification_token: Some(
+        "PID",
+    ),
+    email_verification_sent_at: Some(
+        DATE,
+    ),
+    email_verified_at: None,
+    magic_link_token: None,
+    magic_link_expiration: None,
+}
--- a/tests/tasks/mod.rs
+++ b/tests/tasks/mod.rs
@@ -0,0 +1 @@
+
--- a/tests/workers/mod.rs
+++ b/tests/workers/mod.rs
@@ -0,0 +1 @@
+